[sleuthkit-users] Question about ifind and indirect blocks

[Nelson G. Mejias-D. <nel...@ne...>]

Hi Everyone,

I'm new to this list and I have a question about ifind and indirect blocks in ext2, using sleuthkit 2.03.  When I use the 'ifind' tool and give an indirect block as an argument, to find its inode number, I get an "Inode not found" message.  I want to know if the tool is working correctly or if this indicates a bug.  I did searches in Google and this mailing list but I haven't found an answer for this.

Here is the output of the command line call:

[root@rush bin]# ./ifind -d 4361910 /dev/hda2
Inode not found
Inode not found

where '4361910' is an indirect block number


I took this number from the output of the 'istat' command shown below.

------------ start of command output ------------

[root@rush bin]# ./istat /dev/hda2 2180294
inode: 2180294
Allocated
Group: 133
Generation Id: 2672944929
uid / gid: 0 / 0
mode: -rw-r--r--
size: 613857
num of links: 1

Inode Times:
Accessed:       Wed Jan 18 14:00:47 2006
File Modified:  Wed Jan 18 14:00:47 2006
Inode Modified: Wed Jan 18 14:00:47 2006

Direct Blocks:
4361893 4361894 4361895 4361896 4361897 4361898 4361899 4361900
4361901 4361902 4361903 4361904 4361911 4361914 4361915 4361916
4361917 4361918 4361919 4361920 4361921 4361922 4361923 4361924
4361925 4361926 4361927 4361928 4361929 4361930 4361931 4361932
4361933 4361934 4361937 4361938 4361939 4361940 4361941 4361942
4361943 4361944 4362303 4362304 4362305 4362306 4362307 4362308
4362309 4362310 4362311 4362312 4362313 4362314 4362315 4362316
4362317 4362318 4362319 4362320 4362321 4362322 4362323 4362324
4362325 4362326 4362407 4362408 4362409 4362410 4362411 4362412
4362413 4362414 4362415 4362416 4362417 4362418 4362419 4362425
4362426 4362427 4362428 4362429 4362430 4362431 4362432 4362433
4362434 4362435 4362436 4362437 4362438 4362459 4362460 4362461
4362462 4362463 4362464 4362465 4362466 4362467 4362468 4362472
4362491 4362492 4362493 4362494 4362495 4362496 4362497 4362498
4362499 4362500 4362501 4362502 4362503 4362504 4362505 4362506
4362507 4362508 4362509 4362510 4362511 4362512 4362513 4362514
4362515 4362516 4362517 4362518 4362519 4362521 4362522 4362523
4362524 4362525 4362526 4362527 4362528 4362529 4362530 4362531
4362532 4362533 4362534 4362535 4362536 4362537

Indirect Blocks:
4361910

------------ end of command output ------------


Thanks for your help,
Nelson

-- 
Nelson G. Mejias-Diaz
Director of Software Development
Netxar Technologies Inc.
phone: (787) 765-0058 ext 2009
email: nel...@ne...
website: www.netxar.com
--